Authorising channels

Clients cannot join a private, presence or encrypted channel on their own. They ask your backend, which decides whether that person may join and signs a token with the app secret. Arc verifies the signature; it never sees your session or your user table.

Your SDK produces the token, so the endpoint is a few lines:

# Django
def realtime_auth(request):
    channel = request.POST["channel_name"]
    socket_id = request.POST["socket_id"]

    if not can_join(request.user, channel):
        return HttpResponseForbidden()

    data = None
    if channel.startswith("presence-"):
        data = {"user_id": str(request.user.id), "user_info": {"name": request.user.get_full_name()}}

    return JsonResponse(arc.authenticate(channel=channel, socket_id=socket_id, custom_data=data))

What gets signed:

For encrypted channels the SDK also returns a shared_secret, derived from the app's encryption master key, which the client uses to decrypt.